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Abstract 

We report that, for the generation of a secure cryptographic key 
from correlations established through a noisy quantum channel, the 
quantum and classical advantage distillation procedures are not equiv- 
alent, when coherent eavesdropping attacks are duly taken into ac- 
count. The quantum procedure can tolerate markedly more noise in 
the channel than the classical procedure. 

One of the important problems in quantum cryptography is whether clas- 
sical methods of key distillation are equivalent to quantum methods. This 
problem was recently investigated for a certain class of protocols in Refs. 
[U EHH] It was concluded there that the quantum entanglement distillation 
[I] tolerates exactly the same amount of errors in a raw cryptographic key 
as classical advantage distillation [Sj. The analysis was carried out under the 
assumption that Eve performs the most general incoherent attack. 

In this short note [S| we report that this equivalence is only apparent, in 
fact classical advantage distillation is not as powerful as quantum entangle- 
ment distillation. This is so because Eve has the option of coherent attacks 
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which give her more information than what she can get from incoherent at- 
tacks. Roughly speaking, Eve exploits the classical information she gains 
from the public communication exchanged between Alice and Bob as part of 
the advantage distillation protocol. 

Alice sends qunits to Bob, that is n- dimensional quantum systems, and 
the raw key sequence consists of the paired nit values for matching measure- 
ment bases. The security of the protocols of [H 121 13] for quantum cryptogra- 
phy can be expressed solely in terms of the probability (3q that Alice and Bob 
get the same nit value if the bases match. (We are adopting the notation 
of Ref. [J.) For an ideal noiseless quantum channel, one has (5q = 1, and 
(3q = 1/n obtains for a channel that has nothing but unbiased noise. Chan- 
nels with some admixture of noise are characterized by (3$ values between 
those extremes. 

The lesson of Refs. [7J E] is that classical advantage distillation can be 
performed successfully if 

A)> , 2 7T = /3f c) (old threshold) (1) 
2 + [n — 1) 

which is also the threshold for quantum entanglement distillation [3]. This 
result is valid provided that incoherent eavesdropping attacks supply as much 
information as possible. This assumption is not implausible, inasmuch as 
Gisin and Cirac [S], and Wang P argued that coherent eavesdropping attacks 
cannot be more powerful than incoherent ones. 

In the context of advantage distillation, however, there is a self-suggesting 
coherent attack that truly outperforms the best incoherent attack. Instead 
of measuring her ancillas one by one, Eve performs a collective measurement 
on a naturally chosen subset. We analyzed this scenario in full and find that 
the threshold of (JTJ) is too optimistic. Rather, the true threshold is given by 

A)>— 7 — 4^ ^/#° h) (new threshold). (2) 

2 + (3 - Vo)(n - 1) 

This is a substantially more stringent condition on (3q than the one in (0) 
that is derived for incoherent attacks only; see Fig. ^ 

We are indebted to Ajay Gopinathan, Christian Kurtsiefer, Yeong Cherng 
Liang and Christian Miniatura for sharing their insights with us. This work 
was supported by A*Star Grant No. 012-104-0040. 
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Figure 1: Threshold values /3 
dashed line) and coherent attacks (/3 



for incoherent attacks ((3q = J3q , 
(thr) = ^coh)^ golid Une ^ for 2 < n < 25. 
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